Privacy Notice for Students

Personal data is information that SS&SA holds about you and which identifies you. This includes information such as your date of birth and address, as well as information like exam results and grades, scholarship and funding information, admissions records, and disciplinary records.

Under the GDPR, special categories of personal data are afforded an extra level of security and confidentiality. This includes information about racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, data concerning health, or data concerning sex life or sexual orientation.

The personal data that SS&SA holds about you is obtained from a number of sources and may include the following types of information:

• Admission information, including information identifying potential candidates for admission from third-party sources; information you have provided on your application through application platforms and via a third party, such as testing organizations; information from references; and information from educational institutions attended previously;
• Personal information that you provide after admission, including demographic information, parents and emergency contacts information, housing requests;
• Information about your education, including information that you provide to us during the course of your education and information related to your education, such as your grades and courses taken (including research experience and resume information); internship, fellowship and student leadership applications; and enrollment status changes or disciplinary actions, if any;
• Information about your participation in athletics, including through student-athlete forms;
• Funding information, such as information from the Free Application for Federal Student Aid (FAFSA) or from external fellowship or scholarship providers; and billing information, such as home address and billing contact;
• Information from partner organizations, such as professional bodies, employers, and other educational establishments for the purposes of study or research abroad or exchange programs;
• Passport information;
• Religious preference, but only if you choose to provide it, and for the sole purpose of connecting you to the religious community of your interest;
• Medical information, such as information about any disabilities that you disclose or pertinent medical conditions; special accommodations for any learning or physical disabilities; health insurance information; and information that you supply to University Health Services (UHS) as part of matriculation, including your health history and immunization records; and
• Criminal history information, such as previous convictions for any European visa processing purposes.

Our primary reason for collecting and using your personal data is to provide you with an education. When you apply and accept an offer to attend SS&SA, you agree that we can process your personal data for administrative and educational purposes. The purposes of processing include, but are not limited to:

• Administering and providing education and training;
• Administering and providing housing;
• Managing and administering our services, including accommodation services;
• Administering financial aid or support;
• Providing advice and support to you, including health care services, health and safety, attendance monitoring, and academic and career information and guidance;
• Managing behavioral or disciplinary issues and complaints;
• Recruitment, admission and enrollment;
• Providing you with information about educational programs and services;
• Analyzing and improving our educational programs;
• Maintaining your student record and managing academic processes;
• Administering financial matters including payment of fees;
• Managing facilities including libraries and athletic facilities;
• Managing your immigration-related information and records, if any;
• Institutional research and studies to support University decision making and planning;
• Graduation and confirmation of awards;
• Alumni membership;
• Statistical and archival purposes;
• Regulatory reporting;
• Complying with applicable laws and regulations, including NCAA regulations; and
• Verifying your enrollment and your degrees.

For these purposes, personal data may also be transferred to countries outside of the United States, to countries which may not have data protection laws that offer the same protections as your home country. Examples of circumstances when personal data may be transferred outside the U.S. include:

• Managing collaborations with overseas educational institutions including study and research abroad and exchange programs;
• If you experience a health emergency in another country;
• Working with overseas recruitment agencies;
• Providing external providers of student financial support verification of enrollment and progress;
• Information posted on our website which is accessible outside the U.S.;
• Verifying your enrollment and your degrees; and
• Some of the systems and services the University uses to store data in the cloud which may include storage facilities based outside the U.S.

The European Commission has produced a list of countries which, according to the Commission, have adequate data protection rules. The list can be found on the European Commission Adequacy decisions page.

If the country that we are sending your information to is not on the list, or is not a country within the EEA (which means the EU, Liechtenstein, Norway and Iceland), then it might not have the same level of protection for personal data as the EU provides.

Upon request, we will provide you with additional information about the safeguards which SS&SA has in place outside of this privacy notice. If you have any questions about the safeguards that are in place, please contact the Information Security Office at security@berkeley.edu.

We may share your personal data with the following third parties or for the following purposes:

• With our service providers: We may share your personal data with third parties that help us provide services to you. For example, we may share some information with our insurance company to make sure that we have the insurance coverage that we need, or with vendors who provide or support the online or electronic tools that you use.
• To improve our services: For example, we may occasionally use consultants, experts, or other advisors to assist us in fulfilling its obligations and to help run the university properly. We might need to share your information with them if this is relevant to their work. For example, we may share your personal data with the National Student Clearinghouse to help meet SS&SA's compliance, administrative, student access, accountability, and analytical needs.
• With government entities: In response to a valid government request, we may share your personal data with a government agency or law enforcement. We may also be required to report certain personal data, for example, to the Department of Education, to comply with our obligations under U.S. law or to protect our rights or the rights of others, or prevent fraud or other criminal activity.
• With parents or legal guardians: If you are a minor, we may be required by law to share certain personal data with your parents or legal guardians.
• With other educational institutions: If you choose to continue your education at another institution, we may share information about your education at SS&SA with such institution.
• With external providers of financial support: So that they may verify enrollment and progress.
• With the public: After obtaining your consent, we may share information about you on our website, such as information about your achievements or photographs of attendees at university events.

Third parties that receive your personal information from us are required to abide by applicable law in their use of your information.

This section contains information about the legal bases that we are relying on, for purposes of the GDPR, when processing your personal data.

Legitimate interests

Absent overriding, countervailing interests, SS&SA may process your personal data for its legitimate interests. Specifically, SS&SA has a legitimate interest in:

• Providing you with an education;
• Safeguarding and promoting your health and welfare and the health and welfare of other students;
• Promoting the objectives and interests of the university, including fundraising and marketing;
• Facilitating the efficient operation of the university; and
• Ensuring that all relevant legal obligations of the university are complied with.

In addition your personal data may be processed for the legitimate interests of others. For example, we may process your personal data when investigating a complaint made by another student.

If you object to SS&SA using your personal data in a particular situation, please contact sssb-privacy@berkeley.edu.

Legal obligation

SS&SA may process your personal data in order to comply with a legal obligation, for example, to report a concern about your wellbeing to the appropriate government agency. We may also have to disclose your information to third parties such as the courts, local authorities, or law enforcement where legally obliged to do so.

Vital interests

SS&SA may need to process your personal data to protect your vital interests, or someone else's, for example, to prevent someone from being seriously harmed or injured.

Public interest

SS&SA is acting in the public interest when providing students with an education, and we may process your personal data in connection with that public interest.

Special categories of personal data are treated with extra sensitivity. These special categories include: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, genetic information, health information, and information about sex life or orientation. SS&SA may process special categories of personal data under the following legal bases:

Substantial public interest

The processing is necessary for reasons of substantial public interest.

Vital interests

To protect the vital interests of any person where that person cannot give consent, for example, if they are seriously hurt and are unconscious.

Legal claims

The processing is necessary for the establishment, exercise or defense of legal claims. This allows us to share information with our legal advisors and insurers.

Emergency circumstances and medical purposes

This includes medical treatment and the management of healthcare services.

Consent

We may ask for your consent to use your personal data in certain ways. If we ask for your consent to use your personal data, you can revoke this consent at any time. Any use of your personal data before you withdraw your consent remains valid. If you would like to revoke any consent given, please contact sssb-privacy@berkeley.edu.

We keep your personal data for a minimum of 5 years in order for you to complete your education. If you stop attending SS&SA prior to completing your education, or apply and do not attend, we will retain your personal data as required for operational and regulatory needs, or in case you want to apply again. We will keep certain personal data after you are no longer attending SS&SA, for example, so that we can confirm your completion of your degree, share your personal data with another educational institution should you choose to apply for admission elsewhere, or invite you to participate in alumni events.

We may keep certain personal data indefinitely for historical, research, or statistical purposes for a longer period than 5 years.

We will also keep your personal data for as long as necessary to comply with applicable record retention laws and obligations.

Subject to certain limitations and conditions, you have the following rights with regards to the processing of your personal data:

• Right of access: You have the right to request access to the personal data that we hold about you.
• Right of rectification: You have the right to correct personal data that we hold about you that is inaccurate or incomplete.
• Right to erasure: In certain circumstances, you have the right to request that certain personal data we hold about you be erased from our records.
• Right to restriction of processing: In certain circumstances, you have the right to restrict certain processing of your personal data.
• Right of portability: You have the right to request that personal data we hold about you be transferred to another organization.
• Right to object: You have the right to object to certain types of processing of your personal data, such as direct marketing (to the extent applicable).
• Right to judicial review: In the event that we refuse a request under rights of access, we will provide you with a reason. Individuals in the EU have the right to object as outlined in the “Further Information and Guidance” section below.

Please contact us using the information below should you have any questions or concerns.

Please contact sssb-privacy@berkeley.edu if:

• You object to us using your personal data for marketing purposes, e.g., to send you information about University events.
• You would like us to update the personal data we hold about you.
• You would prefer that certain information about you is kept confidential.

If you believe that we have not acted properly when using your personal data you can file a complaint with the appropriate supervisory authority in the EU (see the European Commission Data Protection Authorities webpage).